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(54) Postage meter having electronic access control security 



(57) A postage meter which can be accessed and 
reset electrically through use of a two-part coded pass- 
word sent by a postal employee toa meter manufacturer 
and an encrypted security code sent by the meter nnan- 
ufacturer to the postal employee for use in putting the 
postal meter in a reset nrxxJe for resetting postage reg- 
isters in the meter Enhanced security is realized by the 
meter manufacturer validating the first part of the pass- 
word as identifying an authorized postal employee 
and/or post office station and the second part as asso- 



ciated with a legitimate meter arid then issuing the en- 
crypted security code to the postal employee for reset- 
ting the meter. The encrypted security code is based on 
a variable amount of credit with which a register of the 
meter is to be reset and the security code input to the 
meter is compared with a corresponding code generated 
by the meter based on an input of the variable credit 
amount to ensure that the meter is reset with an author- 
ized credit amount 
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Description 

This application is a continuation-in-part of U.S. Se- 
rial No. 08/091,098, filed with the United States Patent 
and Trademari< Office on July 13, 1993. 

This invention relates generally to electronic post- 
age meters, and more particularly the invention relates 
to a postage meter having electronic access control tor 
enhanced security. 

A postage meter normally includes a postage selec- 
tion mechanism, a postage printing mechanism, and a 
plurality of internal registers for maintaining accounting 
information. The internal registers vnosH commonly con- 
tain numerical values representative of the total postage 
paid for (control total), the total postage printed (ascend- 
ing balance or ascending register), and the total postage 
rennaining (descending balance or descerKling register). 
The information contained in the internal registers is re- 
dundant, since the ascending balance and descending 
balance normally sum to the control total. 

Prior to using the meter, a user must buy from a post- 
al service employee a fixed aniount of postage. The post- 
al sennce employee accesses the internal registers 
through a mechanical key lock/swttch and alters the con- 
tents of the internal registers to reflect the amount of 
postage paid by increasing the control total and the de- 
scending balance by this amount. To use the meter, the 
user first selects the value of postage to be printed, and 
then activates the printing mechanism. The meter may 
be used until the descending balance reaches a prede- 
termined minimum (e.g.. until the postage paid for has 
been exhausted or has reached a minimum threshold 
value). 

It can be seen that postage meters are subject to 
stringent security requirements to insure that all postage 
actually printed has been paid for, and that the meter is 
rK>t in the possession d an unauthorized user or a licen- 
see in default on his license. Thus, the level of security 
can be measured by the difficulty of activating the meter 
printing mechanism without correspondingly updating 
the counting registers within the meter, and also by the 
difficutty of altering or losing the meter register values, 
whether intentionally, inadvertently, or accidentally. To 
this end, the print mechanism and the counting registers 
are located within a secure housing, and access thereto 
is restricted to the manufacture of the meter under postal 
service supen/ision, with partial access also allowed to 
postal sen^ice emptoyees when they reset the meter. 

The present invention provides enhanced security 
by replacing the mechanical key lock/switch with an elec- 
tronic access control system requiring the partidpatkxi 
of the meter manufacturer prior to resetting of the meter. 

The present invention provides improved security, 
facilitates the administration and control of postage me- 
ters, and enhances the collection df data on the meter 
population. Briefly, and in accordance with the invention, 
a postage meter is reset by a postal service empbyee 
only after an encrypted security code is issued to the 



postal empbyee by the meter manufacturer or other au- 
thorized entity. 

After the meter is delivered to the postal employee, 
the employee activates a Security Access mode in the 

s meter by activating a dedicated switch in the meter or 
altematively by depressing a specific combinatbn of 
keys, which keys may be bcated on the main keyboard 
used for all functkxis in all modes or, alternatively, may 
be located on an auxiliary keyboard dedicated to reset- 

10 ting functbns only Ttie switch and/or the auxiliary key- 
board, if either or both are used, will normally be located 
in a chamber in the meter which is sealed by a wire and 
crimped lead rertKivable by the postal employee. 

Thereafter, the postal empbyee sends a coded 

IS two-part password to the meter manufacturer, the first 
part of whbh identifies the postal employee or the post 
office station and, if valkJated by the meter manufacturer, 
enables the transmittal of the second part which identi- 
fies the meter and can provkJe other informatbn as pre- 

20 scribed by the postal authorities and the meter man uf ac- 
turer. The manufacturer, through a central computer for 
example, verifies the password and issues an encrypted 
security code whk:h is required to enable the postage 
reset operation. Alternatively, the password might not be 

25 correct or might identify an unauthorized meter, in whbh 
case the security code is withhekj and possibly the meter 
is confiscated. 

The security code can be a changing code which is 
operable only once, or a fixed code which can be used 

30 repeatedly. The security code is entered into the meter 
by the mam or auxiliary keyboard, and when the meter 
verifies the code, the meter is placed in a post office reset 
(PO) mode which enables the reset of revenue registers. 
After reset of the registers, the meter is retumed to a 

35 standard operating mode by the postal empbyee using 
keyboard entries. 

The invention and objects and features thereof will 
be more readily apparent from the folbwing detailed de- 
scription and dependent claims when taken with the 

40 drawing. 

Fig. 1 is a functional bbck diagram of an electronic 
postage meter in which the present inventbn is 
empbyed; and 

45 

Figs. 2a and 2b are a flow diagram of the process in 
resetting a postage meter in accordance with the 
inventbn. 

50 Figs. 3a and 3b are a flow diagram of a nrxxJified 
process in resetting a postage meter in accordance 
with the invention. 

Refening now to the drawing, Fig. 1 is a block dia- 
55 gram of a postage meter 10 in which the present inven- 
tion Is empbyed. Meter 10 includes a print mechanism 
12, accounting registers, and control electronics, all en- 
cbsed within a secure meter housing 1 3. A keyboard 14 
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and a display 16 provide the user interface. A connector 
17 provides an electrical connection with a mailing ma- 
chine for control of the printing process. The control elec- 
tronics includes a digital microprocessor 18 which con- 
trols the operation of the meter, including the basic func- 
tions d printing and accounting for postage, and optionat 
features such as department accounting. The microproc- 
essor is connected to a clock 20, a read only memory 
(ROM) 22. a random access memory (RAM) 24, and a 
battery-augmented memory (BAM) 26, 

ROM 22 is primarily used for storing nonvolatile in- 
formation such as software and data/function tables nec- 
essary to run the microprocessor. The ROM can only be 
changed at the factory. RAM 24 is used for intermediate 
storage of variables and other data during meter opera- 
tion. BAM 26 is primarily used to store accounting infor- 
mation that must be kept when the meter is powered 
down. The BAM is also used for storing certain flags and 
certain information that is necessary to the functioning 
of the microprocessor. Such information includes meter 
identifying data such as the meter serial number and the 
BAM initialtzatkvi date, a control total (CT) register, a de- 
scending register (DR), an ascending (AR), and an- en- 
crypted security code. A sealed switch or an auxiliary 
keytxsard 28, if either or both are provided, will be located 
within the secure meter housing 1 3. 

The postage meter is delivered to a post office em- 
ployee for resetting the descending register The postal 
employee must place the meter into a Security Access 
mode as a prerequisite to setting the registers; in this 
operating mode, the meter can receive an encrypted se- 
curity code which will be provkled by the meter manu- 
facturer's central office computer. In one implementation, 
neither the sealed switch 28 or the auxiliary keyboard 28 
are provided: Security Access and PO modes are both 
set through the main keytx>ard 14akxie. In a secortd im- 
plementation, auxiliary keylx)ard 28 is not provkied; Se- 
curity Access rrKxie is set using the sealed switch 28, 
and PO mode is set using main keyboard 14. In a third 
implementatbn. Security Access mode is set by sealed 
switch 28, and PO mode is set using auxiliary keyboard 
28 within the secure meter housing. In a fourth imple- 
mentatkxi, sealed switch 28 is not provided, and Security 
Access and PO modes are set by means of auxiliary key- 
board 28 akxie within the secure meter housing. 

A postal kJentifk^ation password is then transmitted 
to the meter manufacturer's central office computer by 
the postal employee at 33, which identifies either the em- 
ployee of the post offk:e. If this kientifk^ation is recog- 
nized, the empbyee then transmits the meter identifica- 
tkxi password, and the computer sends back an encrypt- 
ed security code whk:h will enable the employee to place 
the meter into PO mode for accessing the descending 
register. The postal employee then enters the encrypted 
security code through the keyboard on the meter or 
through the auxiliary keyt)oard to put the meter into a re- 
set mode. The meter can be made resistant to tri- 
al-and-error experimentatkxi or hacking by requiring that 



the code must be entered correctly within a specified 
number of attempts. Exceeding the retry limit puts the 
meter into a lockout mode where the meter can be nei- 
ther reset nor operated to print postage. The meter man- 

5 ufacturer must then be contacted for additbnal specific 
procedures for clearing the lockout. 

The encryption algorithm can produce a changing 
code which is unk^ue to an individual meter and valid for 
a single postage value reset transaction. In this version, 

10 each change from the PO mode to reset mode requires 
a complete new cycle of communk:ation with the manu- 
facturer's central computer In another software versk)n, 
the encrypted security code issued by the central office 
computer is unique to the indivkluai meter, but may be 

IS used as many times as desired to switch the meter from 
Security Access nrxxie to PO mode with no further ac- 
cess to the manufacturer's central computer 

The dedk:ated switch or auxiliary keytx^ard may be 
located inskJe a door in the meter cover which can be 

20 secured by sealing with a wire and crimped lead as re- 
quired by postal regulations for physical security of the 
key kx^k/switch. Once the encrypted security code has 
been entered, the meter can be designed to albw the 
remainder of the transactbn to be done through the aux- 

2S iiiary keytx>ard or the main keyboard. 

Figs. 2a and 2b are a fiow diagram of the resetting 
process. The meter as delivered to the post office by the 
user or meter manufacturer's representative at 30 for re- 
set is in a standard operating mode: The postal employ- 

30 ee puts the meter in the Security Access mode at 32 us- 
ing the sealed switch or auxiliary keyboard 28 in Fig. i . 
The postal employee then sends a coded password to 
the meter manufacturer's central computer by telephone 
line from a computer terminal with modem in the post 

3S office or by voice communk^tion using the telephone ei- 
ther via an audio response unit or through an intermedi- 
ary operator The postal identificatk>n password contains 
kientifying information as prescribed by the postal au- 
thorities. whk;h may include any or all of the following: 

40 Post office statbn identity code 

Postal empkiyee identity code 
If the postal identificatkxi password is not recognized by 
the meter manufacturer's computer at 35, the computer 
aborts the procedure and defaults to a live operator at 

45 38, who can then take action appropriate to the circum- 
stances. If the postal identification password is recog- 
nized by the computer, the computer then accepts the 
entry of the meter kJentificatk)n password at 34; content 
of the meter identification password is determined by the 

so meter manufacturer and may include any or all of the fol- 
k)wing: 

Post office statbn identity 
Postal empbyee identity 
Meter serial number 

ss User's meter license number (unique to user) 

Meter status: "In Servrce," 
"New Installatkxi,' or 'Withdrawal" 
Revenue register contents (DR, AR and CT) 
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The manufacturer's computer then validates the 
password at 36. If the password is not recognized or rf 
the meter license number has been flagged in the com- 
puter as being invalid, the computer aborts the proce- 
dure and defaults to a live computer operator at 38 who 
can then take action appropriate to the circumstances. 

If the password is recognized but the user has a de- 
linquent account as noted at 40, the live operator again 
takes over at 38. If the account is not delinquent, then 
the central computer issues an encrypted security code 
to the postal employee at 42, The encrypted security 
code can be used to enable the postage reset operatkxi 
if correctly entered in a specified number of tries. The 
encrypted security code will appear on the post offk:e vkJ- 
eo display terminal, VDT, screen, if used, or else will be 
heard by the postal employee over the telephone, either 
synthesized through the audio response unit, ARU. or 
spoken by the meter manufacturer's operator. 

The security code in accordance with one embodi- 
ment is encrypted as a changing code whk:h works only 
once in enabling the meter. Alternatively, the security 
code can be encrypted as a fixed code which works re- 
peatedly with the meter without further communicatkxi 
with the central processor. The encrypted security code 
can also contain other kJentifying infomnation as pre- 
scribed by postal authorities including any or all of the 
foltowing: 

Meter serial number 
User's meter license number 
Meter status, "In Sendee,* 
■New Installatkxi," or "Withdrawal" 

The postal enrtpbyee then enters the encrypted se- 
curity data into the meter by means of the main keytx>ard 
or by the auxiliary keyboard as shown at 44. If the meter 
verifies the encrypted security code at 46, then the meter 
nrwes from the Security Access nrxxJe to the PO mode 
at 48 which enables the reset of the descending regis- 
ters. However, if the password verifk:ation at 46 is un- 
successful and the maximum retries has not been 
reached as determined at 48. then an error message in- 
structing try again is noted at 50. If the password verifi- 
cation is unsuccessful within a predetermined number of 
attempts, the meter goes into a k>ckout nrKtde at 52 and 
the manufacturer must be contacted for specific additbn- 
al procedures to clear the lockout and altow the resetting 
process to continue. 

If the code is validated by the meter at 46, the meter 
then goes to the reset mode at 54 which enables the re- 
set of the descending register. The postal empbyee then 
resets the meter registers using either the main or aux- 
iliary keyboards at 56. Thereafter, the meter is returned 
to the standard operating mode by the postal empbyee 
through use of keyboard entries at 58, and the meter is 
returned to the user or to the meter manufacturer's rep- 
resentative at 60. 

The inventbn provides a number of advantages as 
compared to the existing system of mechanically locked 
key switch bcated behind a sealed door including greatly 



improved security, better protection of postal service rev- 
enues, easier and more effective administration and con- 
trol of postage meters, real time control of meters, and 
enhanced collection of data on the meter populatbn. The 

s electronic key aspect of the system provides access via 
encrypted security codes that are unk^ue to a single me- 
ter as opposed to the present key lock system in which 
many meters are keyed alike with a single key. Thus, in 
the fixed code software versbn, a stolen code would al- 

10 bw ongoing illegal access but only to one particular me- 
ter. Further, in the changing code software version, a sto- 
len code cannot provkJe any illegal access since each 
encrypted security code can be used only once. 

Better administratbn and control of meters is pro- 

75 vkied since a meter manufacturer can request the post 
office to cancel a meter Ibense for nonpayment of rental 
fees. If the company is not successful in retrieving a me- 
ter after the Ibense has been cancelled for nonpayment, 
the meter's serial number and use status in the password 

20 can be flagged so that the meter is identified when the 
password is transmitted. The meter manufacturer can 
then prevent the reset by programming its computer to 
refuse an encrypted security code to specified pass- 
words, and rf desired, may also telephone the postal em- 

25 pbyee to request confiscation of the meter thus realizing 
real time control of meters. Further, the password can be 
used for data collectbn which is useful to the meter nnan- 
ufacturer and the postal sen/ice in maintaining real time 
control of the meters and for determining revenue usage 

30 paltems and meter inspection data. By including this 
data as part of the password, automatic and accurate 
reporting of the informatbn in a standardized format to 
the central computer system is provbed. 

The resetting process described hereinbefore pro- 
as vbes security in permitting access to the postage meter 
fro resetting the value of credit only to an authorized post- 
al empbyee. In a nruxiificatbn of the process, increased 
security in respect of the variable amount of credit en- 
tered into the meter is provbed such that only a variable 

40 anxjunt of credit authorized by the manufacturer's cen- 
tral computer can be entered into the postage meter and 
hence the central computer can maintain a record of the 
anrxDunt of credit with which a postage meter is reset in 
each resetting transactbn. Accordingly even if a reset- 
ting transactbn is carried in an unauthorized and possi- 
bly fraudulent manner, the post offbe can be provided 
with a copy of the record of resetting transactions from 
the central computer to enable verificatbn of each reset- 
ting transaction and hence of proper accounting for the 

so credit values entered into the meter Figs. 3a and 3b are 
a flow diagram of the modified resetting process. Steps 
in the flow chart of Figs. 3a and 3b which correspond to 
an are the same as those of the fbw chart of Figs. 2a 
and 2b are referenced with the same reference numer- 

55 ats. After the meter is delivered to the post office by the 
user or meter manufacturer's representative at 30, the 
postal employee puts the meter into the Security Access 
nnode at 32 by opening a post office seal on the meter 
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and using the sealed switch or auxiliary keyboard 29 in 
Fig. 1 and the postal empbyee sends a post office iden- 
tification code at 33 to the meter manufacturer's central 
computer by telephone line from a computer terminal In 
the post office or by voice communication using the tel- 
ephone either via an audio response unit or through an 
intermediary operator at the location of the central com- 
puter. If the post office identification code is recognized 
by the central computer the post office empbyee then 
sends a meter password at 61 relating to the specific 
postage meter to be reset and to a variable credit amount 
(AC) by which the amount in the descending register of 
that meter is to be incremented in the resetting process 
to the rr^eter manufacturer's computer Accordingly the 
meter identification password includes any or all of the 
information items set out hereinbefore in relation to Fig. 
2a and 34 ar>d also includes the selected variable credit 
amount (AC). Also values stored in other registers d the 
meter may be required to be sent. The central computer 
carries out a validation routine at 61 in respect of the in- 
formation sent by the postal employee. If the received 
information is valid and if the user does not have a de- 
linquent account as determined at 40, the central com- 
puter generates an erK;rypted security code and this se- 
curity code is transmitted at 62 to the postal employee. 
If the corhputer does not recognize the post office iden- 
tification at 35. the information sent to the computer is 
not validated at 61 or the account is delinquent at 40, the 
procedures as shown in Fig. 2a and described hereinbe- 
fore are carried out. 

The encrypted security code generated by the cen- 
tral computer and transmitted to the postal employee is 
generated using the variable amount of credit (AC). In 
addition it is preferred thiat apart from being based on the 
amount of credit (AC), the security code changes for 
each resetting trartsaction and works only once for per- 
mitting resetting of the postage meter. Accordingly in ad- 
dition to being based on the variable credit amount (AC), 
the code is preferably based on a pseudo-random 
number generated by a pseudo-rarKkxn number gener- 
ator in the central computer which is incremented for 
each resetting transaction. The pseudo-random number 
generator may be implemented by a microprocessor of 
the central computer and an algorithm. 

Upon receipt of the encrypted security code trans- 
mitted from the central computer, the postal employee 
enters into the meter at 63 by means of the main key- 
board or the auxiliary keyboard the received encrypted 
security code together with the variable amount of credit 
(AC). The microprocessor 1 8 of the postage meter op- 
erates in conjunction with an algorithm to generate an 
Internal code based on the entered variable amount of 
credit (AC) in the same manner as the central computer 
and compares the encrypted security code input by the 
postal employee with the Internal code generated in the 
meter to valkiate at 64 the entered encrypted security 
code. If the comparison is successful the microprocessor 
18 of the meter resets the credit in the meter by incre- 



menting the descending register of the meter by the 
arrKiunt of credit (AC). If the comparison is unsuccessful, 
the meter carries out the procedure as shown at 48, 50 
and 52 as described hereinbefore in relation to Fig. 2b. 

s The postal empbyee verifies at 65 the setting of the reg- 
isters to verify that the resetting procedure has been car- 
ried out satisfactorily and restores the meter to standard 
operating mode by entry on the keyboard, either main or 
auxiliary. If the post office seal has been opened for the 

10 resetting procedure, the meter is resealed and the meter 
Is released by the post office at 60 and returned to the 
user or manufacturer's representative. 

It is envisaged that the central computer is bcated 
at a meter manufacturer's premises and is operated by 

IS the meter manufacturer However, if desired the central 
computer may be located in post office premises and be 
operated by the post office. The computer may be a cen- 
tral installatbn or may be a distributed system bcated in 
the post office. 

20 While the Inventbn has been described with refer- 
ence to a specific embodiment, the description is illus- 
trative of the invention and is not to be construed as lim- 
iting the inventbn. Various modifications and applica- 
tions may occur to those skilled in the art without depart- 

2S ing from the true spirit and scope of the invention as de- 
fined by the appended claims. 



Claims 

30 

1. A method of electronically accessing and resetting 
a postage meter by a postal employee with 
enhanced security comprising the steps of 

35 (a) delivering said postage meter to said postal 

employee, 

(b) accessing a meter manufacturer's computer 
with a coded password identifying said postal 

40 empbyee and/or a post office statbn, 

(c) accessing a meter manufacturer's computer 
with a coded password identifying said postage 
meter, 

45 

(d) transmitting an encrypted security code to 
said postal empbyee after verificatbn of sakJ 
coded password by said meter manufacturer, 

so (e) entering said encrypted security code Into 

said postal meter, and 

(f) resetting postage registers in sab postal 
meter 

55 

2. The method as defined by claim 1 wherein step (a) 
further includes putting said postal meter in a post 
office (PO) mode by said postal employee. 
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3. Tlie method as defined by claim 2 wherein said post 
office mode is entered by a dedicated switch sealed 
In said postage meter. 

4. The method as defined by daim 2 wherein said post 
office mode is entered by an auxiliary keyboard 
sealed in said postage meter 

5. The method as defined In Claim 1 wherein said post 
office mode is entered by the non-sealed main key- 
board of the postage meter. 

6. The method as defined by claim 1 wherein step (b) 
Is performed over a telephone line. 

7. The method as defined by claim 6 wherein step (b) 
accesses a computer of said meter manufacturer. 

8. The method as defined by claim 1 wherein step (d) 
Includes transmitting a changing code whbh is 
unk^ue to one postage meter and valid for a single 
transact k)n. 

9. Ttie method as defined by claim 1 wherein step (d) 
includes transmitting a code which is unque to one 
postage meter and is valkj for a plurality of transac- 
tkxis. 

10. The method as defined by claim 1 wherein step (e) 
requires correct entry of a valid encrypted security 
code within a specific number of attempts. 

11. The method as defined by claim 10 wherein failure 
to enter a valid encrypted security code within sakf 
specify number of attenrtpts puts said postage meter 
in a lockout mode in whk:h saki postage meter can- 
not be reset or operated to print postage. 



age, 

a mrcroprocessor, and 

means for placing saki postage meter tn a 
standard operating mode tor printing postage, a 
5 Security Access nrKxJe for entering an encrypted 
security code, and a post office mode for resetting 
at least one of said plurality of registers. 

16. The postage meter as defined by claim 15 wherein 
10 said encrypted security code is stored in said mem- 
ory, sakJ mrcroprocessor compares the stored 
encrypted security code with the entered encrypted 
security code before saki reset nrKxie can be 
entered. 

IS 

17. The postage meter as defined by claim 15 and fur- 
ther including a sealed auxiliary keyt>oard for enter- 
ing sakJ encrypted security code during sakj Secu- 
rity Access mode. 

20 

18. The postage meter as defined by claim 15 and fur- 
ther including a seated switch in said postage meter 
for entering said Security Access mode. 

^5 19. TTie postage meter as defined by claim 1 5 and fur- 
ther including a means for entering sakJ post office 
mode through nnanipulation of one or a combinatbn 
of two or more keys of the meter's main keyboard, 
whk:h main keyboard is not sealed and is accessible 

30 at all times to all users of the meter and is the same 
keyboard used to control all other functions of the 
meter in all of its operating modes. 

20. A method of electron k:ally accessing and resetting 
35 values in a postage accounting register of a postage 
meter at a post offbe location by a postal empbyee 
comprising the steps of 



IS 



12. The method as defined by claim 1 wherein step (f) 
includes accessing registers in said postage meter ^ 
through a keyboard of sakJ postage meter. 

13. The method as defined by claim 1 and further includ- 
ing 

(g) nnanually switching said postage meter to 
a standard operating mode. 

14. The method as defined by claim 13 wherein sakJ 
standard operating rrKxie is entered through a key- 
board of saki postage meter. so 

15. A postage meter which can be accessed and reset 
electrbally comprising 

an operating keyboard, 

a memory, ss 
a plurality of registers including a control total 
register, a descending register of unused prepaid 
postage, and an ascending register of printed post- 



(a) delivering said postage meter to sakJ postal 
employee at said post office location, 

(b) accessing a computer with a first coded 
password identifying at least one of said post 
office bcatbn and said post offrce employee, 
with a second coded password identifying said 
postage meter and with a selected variable 
amount of credit by which said postage account- 
ing register of sakJ meter is to be incremented, 

(c) verifying at said computer said coded pass- 
words, 

(d) after said verification of said coded pass- 
word, transmitting an encrypted security code 
base on sai6 selected variable amount of credit 
to sab postal employee, 

(e) entering said encrypted security code and 
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said selected variable amount of credit into said 
postage meter. 

(f) in said postage meter generating an internal 
code based on said selected variable amount of 
credit and comparing said intemal code with 
said encrypted security code entered into said 
postage meter, 

(g) in response to said comparing being suc- 
cessful resetting the postage accounting regis- 
ter by incrementing said postage accounting 
register by said selected variable amount of 
credit. 

21 . The method as defined in daim 20.wherein access- 
ing the computer in step (b) includes sending 
accounting infomnation stored in at least the 
accounting register of the postage meter to the com- 
puter and wherein step (c) includes verifying the 
accounting information sent to the computer. 

22. The method as defined in claim 20 wherein the com- 
puter is operated by a meter manufacturer and 
wherein step (e) is performed by the post office 
empbyee. 

23. The method as defined in claim 20 wherein the com- 
puter is operated by the post office and wherein step 
(e) is performed by the post office employee. 

24. The method as defined in claim 20 including the 
step, prior to entering the encrypted security code 
into the postage meter, dt the post office employee 
putting the postage meter into a post ofTtce security 
access mode. 

25. The method as defined in claim 24 wherein the post- 
age meter is put into the security access mode by 
operation of a dedicated switch accessible onty by 
breaking a seal in the postage meter 



ting of the postage meter. 

29. The method as defined in claim 28 including the step 
of putting the meter into a lock-out mode in which 
5 the postage meter cannot be reset on failure to enter 
a valid encrypted security code within a predeter- 
mined number of attempts to enter the encrypted 
security code, 

10 30. A postage meter including an electronic circuit for 
carrying out accounting and control functions, said 
circuit including a non-secure keyboard for use oper- 
ating the postage meter to print postage, an 
accounting register for storing accounting data; 

IS mode switching means operable to put the postage 
meter selectively into an operating mode for printing 
postage and into a secure access nrKxie for resetting 
the accounting data in said accounting register, said 
circuit being operative when in said secure access 

20 mode in response to input of an accounting value for 
use in resetting the accounting register to generate 
an internal code based on saki accounting value and 
in response to input of said encrypted security code 
to compare sakJ intemal code and said encrypted 

25 security code and if the comparison is successful to 
reset the accounting register in accordance with the 
accounting value. 

31. A postage meter as defined in claim 30 wherein the 
30 mode switching means is operable to put the post- 
age meter into the secure access nrKtde only in 
response to input to the electronic circuit of a secure 
access code. 

35 32. A postage meter as defined in claim 31 including a 
sealed auxiliary keyboard for input of said secure 
access code. 

33. A postage meter as defined in claim 30 wherein input 
40 of the secure access code is by means of the 
non-secure keyboard. 



26. The method as defined in claim 24 wherein the post- 
age meter is put into the security access mode by 
entry of a code on an auxiliary keyboard accessible ^ 
only by breaking a seal in the postage meter. 

27. The method as defined in claim 24 wherein the post- 
age meter includes a non-secure keyboard for entry 

of data to the postage meter by a user of the postage so 
meter and wherein the postage meter is put into the 
security access mode by entry of a code on the 
non-secure keyboard. 

28. The method as defined in claim 20 wherein the S5 
encrypted security code is based on the selected 
variable amount of credit and on a changing number 
unk^ue to the postage meter and to only one reset- 
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